Skip to content
DevMarDe
Crawl Audit check 158Crawl AuditSecurity

DKIM records for email: Crawl Audit check 158

Crawl Audit check 158 looks for a DKIM key on common selectors. What DKIM proves, how to find your own selector, and why this check can miss a valid key.

Zain Kazmi2 min read
On this page
  1. What Crawl Audit checks
  2. What the sources say
  3. Finding your selector
  4. On devmarde.com
  5. Sources
Check
158 of 200
Module
Security & Infrastructure
Group
Server, DNS & File Exposure Security
Impact
Medium

Short answer: DKIM adds a digital signature to every email you send, and receiving servers check it against a public key in your DNS. It proves the mail really came from your domain and wasn't changed on the way. Check 158 looks for that key in the full audit.

What Crawl Audit checks

  • Pass: a DKIM key found on one of 12 common selector names (google, default, selector1, selector2, k1, dkim, s1, mail, smtp, zoho, mandrill, mailjet).
  • Pass: the domain has no mail servers, so DKIM isn't needed.
  • Warning: the domain receives mail but no key was found on those names.
  • The free check doesn't look and shows a warning asking you to confirm it yourself.

DNS can't be searched for every selector, so the check can only try likely names. If your provider uses a different one, you'll see a warning even though DKIM works.

What the sources say

  • RFC 6376: DKIM lets the owner of a domain "claim some responsibility for a message by associating the domain with the message."
  • RFC 6376: the key namespace "is subdivided using "selectors"", so one domain can have several keys.
  • Google: "Sending to personal Gmail accounts requires a DKIM key of 1024 bits or longer." It recommends 2048 bits where your DNS provider supports it.

Finding your selector

  • Send yourself an email, open the full headers, and find DKIM-Signature. The s= value is your selector and d= is the signing domain.
  • Your key lives at selector._domainkey.yourdomain.com.
  • Some providers pick the selector (Google Workspace defaults to "google"). In Zoho Mail, the admin names it.

On devmarde.com

We sign with DKIM, but under selector names that aren't on Crawl Audit's list, so the full audit would warn on our own domain today. We've asked for the list to be widened. Until then, a warning here is a prompt to check your own headers, not proof DKIM is missing.

Sources

All 200 Crawl Audit checks

See how your site does on every check.

Crawl Audit runs this check and 199 others on your domain. The full report is $7.89, one time. The free check on this site covers 25.

Run Crawl Audit · $7.89Free AI visibility check